[PEAR-BUG] Bug #19785 [Opn->WFx]: mysqli quote() security flaw

Edit report at https://pear.php.net/bugs/bug.php?id=19785&edit=1

 ID:               19785
 Updated by:       [email protected]
 Reported By:      peter dot hansen at myloc dot de
 Summary:          mysqli quote() security flaw
-Status:           Open
+Status:           Wont fix
 Type:             Bug
 Package:          DB
 Operating System: Debian Squeeze
 Package Version:  1.7.14
 PHP Version:      5.3.3
 Roadmap Versions: 
 New Comment:

-Status: Open
+Status: Wont fix
mysql::quote() calls DB_common::quoteSmart() which calls
mysql::escapeSimple() which calls PHP's mysql_real_escape_string() if
that exists or mysql_escape_string().

If there's a problem, it's with PHP.


Previous Comments:
------------------------------------------------------------------------

[2013-01-15 08:19:41] empi89

Description:
------------
With mysqli driver quote() does not work as expected. Of course 
this function is deprecated but there should be at least an 
exception when using quote with mysqli as this could be a mayor 
security flaw. 

Test script:
---------------
Suggestion: Add the quote method of mysql.php to mysqli.php too:
// }}}
// {{{ quote()

/**
 * @deprecated  Deprecated in release 1.6.0
 */
function quote($str)
{
    return $this->quoteSmart($str);
}


Test for verifying functionality 
$sql = "`identifier` = ".$db->quote('1234\\')
var_dump($sql);


Expected result:
----------------
string(23) "`identifier` = '1234\\'"

Actual result:
--------------
string(22) "`identifier` = '1234\'"

------------------------------------------------------------------------


-- 
Edit this bug report at https://pear.php.net/bugs/bug.php?id=19785&edit=1